To: 


Of: 


ICO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Energy Suite Limited 


Lomeshaye Bridge Mill 
Bridge Mill Road 
Nelson 

BB9 7BD 


The Information Commissioner (“the Commissioner”) has decided to 
issue Energy Suite Limited (“Energy Suite”) with a monetary penalty 
under section 55A of the Data Protection Act 1998 (“DPA”). The penalty 
is in relation to a serious contravention of regulation 21 of the Privacy 
and Electronic Communications (EC Directive) Regulations 2003 
(“PECR”). 


This notice explains the Commissioner's intended decision. 


Legal framework 


Energy Suite, whose registered office is given above (Companies House 
Registration Number: 09999446) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to regulation 21 of PECR. 
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Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. It means that if a company wants to make calls 
promoting a product or service to an individual who has a telephone 
number which is registered with the Telephone Preference Service Ltd 


(“TPS”), then that individual must have notified the company that they 


do not object to its calls. 
Regulation 21 paragraph (1) of PECR provides that: 


“(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 
Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


"(2) A subscriber shall not permit his line to be used in contravention 


of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 
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(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 
being made on that line by that caller, such calls may be made by 


that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at 
any time, and 
(b) where such notification is withdrawn, the caller shall not 


make such calls on that line.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 
that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The TPS is a limited company 
which operates the register on the Commissioner's behalf. Businesses 
who wish to carry out direct marketing by telephone can subscribe to 
the TPS for a fee and receive from them monthly a list of numbers on 


that register. 


Section 122(5) of the Data Protection Act 2018 (“DPA18”") defines 
direct marketing as “the communication (by whatever means) of 
advertising or marketing material which is directed to particular 
individuals”. This definition also applies for the purposes of PECR (see 
regulation 2(2) PECR & Schedule 19 paragraphs 430 & 432(6) DPA18). 
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“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals". 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 


PECR, as variously amended) states: 


"(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 
Directive) Regulations 2003 by the person, 


(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 
(a) knew or ought to have known that there was a risk that 
the contravention would occur, but 
(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 
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PECR were enacted to protect the individual’s fundamental right to 

privacy in the electronic communications sector. PECR were 

subsequently amended and strengthened. The Commissioner will 

interpret PECR in a way which is consistent with the Regulations’ 

overall aim of ensuring high levels of protection for individuals’ privacy 

rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


Background to the case 


Complaints 


Energy Suite is a company that markets boiler, heating, insulation, 
glazing and other energy-saving grants to homes under government- 
funded schemes. 


Complaints data from the TPS in September 2020 indicated that a 
complaint had been made about calls made from Calling Line Identity 
(“CLI”) 01282612211. A third-party information notice was sent to 
British Telecommunications PLC (BT) on 3 September 2020. BT 
responded on 20 October 2020, identifying Energy Suite as the person 
to whom the CLI was allocated. 


Further analysis identified that there had been three complaints in 
respect of Energy Suite, namely (i) three complaints to the TPS 
between 6 March and 20 July 2020 and (ii) one complaint to the 
Commissioner on 3 August 2020, by a complainant not registered for 


TPS. The complaints included the following comments: 
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“Cold call re eligibility for new boiler and underfloor heating...gov 

scheme (you dont list energy saving in your list to the right of 

this box!) . .. men asking for my husband by name. Saying they 

were calling about the gov boiler scheme. Asked lots of questions 

about the house and any qualifying benefits. Said they check 

with the gov that the person i said gets benefits really does and 

then when that is confirmed they will send a letter and call back 

to make an appt to survey. Didn;t ask for any money or financial 

info. Sounded like a scam but not sure. however it was in total 

breach of TPS. Oh and all the info I gave them was untrue 


anyway!!” [sic][ Complaint to TPS] 


“Calling as they were informed my boiler was in need of 
replacement and I could have a grant from the government. 
They kept asking whether my boiler was over 7 years old. I 
asked where they had got my personal information from (full 
name and telephone number), I was told from a 3rd party but 
they refused to disclose who as it was company policy to keep it 
secret. They ended the call and I called back to try and get more 
details they put me on hold and ended the call twice. I told the 


caller that I would be reporting this incident to the ico.”] 


Two further complaints to the TPS did not give details, save that the 
company that had called them was Energy Suite. Although the 
complaint from the consumer not registered for TPS does not in itself 
indicate a breach of regulation 21, it is included as it gives an example 


of the type and content of call in issue. 


It is possible that more complaints would have been received but for 


Energy Suite’s practice of making a significant volume of calls via 


E c: to which, see below). 
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The Commissioner's investigation 


After conducting his initial investigation, the Commissioner wrote to 
Energy Suite on 13 November 2020 to state that he had opened an 
investigation, to set out the complaints in issue, and to ask some initial 


questions about Energy Suite’s business. 


On 2 December 2020 Energy Suite replied stating that: 


a. Energy Suite had made some 15,000 attempted calls, of 
which 6,000 had connected, in the period from 1 March to 13 
November 2019; 

b. these had been made from the aforementioned CLI as well as 
from three mobile phone numbers and from B 
A 

c. Energy Suite had purchased the telephone numbers in 
question from third parties including iii i iii 
E 


d. all of the data in question had been sourced through third 
parties rather than the contact form on Energy Suite’s 
website; 

e. Energy Suite did not screen these numbers in-house to assess 
whether they appeared on the TPS register, but rather 


purchased the numbers pre-screened. 


Energy Suite provided a data processing agreement with and a 

supplier privacy notice of unclear provenance, entitled “PRIV”. The data 
processing agreement from MM suggests that Energy Suite purchased 
details of 11,005 live, validated landlines and 88,995 live HLR-checked 


mobiles. 
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23. On 16 December 2020, the Commissioner wrote back to Energy Suite 


to request further information, namely: 


Manaos 


. precise call volumes, or details of the dialler operator if 


volumes were not known; 


. details of how opt-ins were obtained; 


clarification of the source of the document entitled “PRIV”; 


. training documents; and 


. evidence of the consent relied upon for the calls made to the 


complainants (i.e. notice that they did not object). 


24. On 13 January 2021 Energy Suite replied stating that it: 


. did not have a dialler, dialled manually, and did not hold 


details of call volumes; 


. did not have any means for checking whether a number was 


TPS registered or had opted into contact from Energy Suite; 


. had received the ‘PRIV’ document from OFGEM, which 


governed the schemes that Energy Suite marketed; 


. did not have a PECR policy or any training records, but would 


welcome guidance from the Commissioner in that regard; 


. had believed that it had consent to call the call recipients on 


the basis of the terms on which it had purchased their data. 


25. On 14 January 2021, the Commissioner wrote again to Energy Suite to 


seek: 


. Clarification of the point at which the data in question was 


screened against the TPS register; and 


. confirmation of how the data that Energy Suite had purchased 


had been obtained by those who supplied it. 
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On 27 January 2021 Energy Suite responded to say that it did not 
check the data against the TPS as it believed the data supplier to be 
reputable, and had been told that the leads in question were not on the 
TPS and had opted in. Energy Suite explained that they did not know 


how the leads had been obtained. 


On 5 February 2021, the Commissioner requested copies of any due 


diligence documents held by Energy Suite, and confirmation of whether 


the J numbers that had called customers 


On the same date, the Commissioner also reviewed the websites of the 


data suppliers. As to those: 


a. B was found to have a website a The 


precise source of | data was unclear from its website, 
although it did state that the data was sourced from lifestyle 
surveys, online comparisons, competition sites and strategic 


partners, and was TPS verified; 


b. a was found to have a website at 
ee There were no clear details on the 


website of how the data sold had been obtained; 


C. similarly, i Website was unclear about the 
provenance of the company’s data, although it did give an 
assurance that the data was accurate and up to date and had 


been provided directly by the potential client. 
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On 19 February 2021 Energy Suite replied to say that the numbers in 


question were Si but provided no new 


due diligence documents. 


On 25 February 2021, the Commissioner sent BT a third-party 
information notice seeking call detail records for the calls from the 
above CLI. BT responded on 26 March 2021, and following further 
communications redirected the Commissioner to | which 
serviced the CLI in question. On 9 April 2021, the Commissioner sought 
call records from] which provided them later the same 
day. 


The records confirmed that Energy Suite had made 3,415 connected 
calls from the aforementioned CLI between 1 March and 13 November 
2020, although some of these may have gone to voicemail. Of those 
calls, 1,202 were made to numbers registered with the TPS, and 44 
were made to numbers registered to the Corporate TPS. The most 
recent registration was 89 days before the call in question. Thus, 
36.5% of the calls made from the CLI in question were to customers 
who had been registered with the TPS (and for at least 28 days by the 


time of the call). 


The Commissioner did not consider it appropriate to seek call records 
from the mobile phone numbers or landlines used, given that they 
were i However, in light of Energy Suite’s 
representation that 6,000 calls had connected, in the relevant period, 


across all CLIs, at least 2,585 connected calls would appear to have 


been made from as 


On 29 April 2021, the Commissioner emailed Energy Suite to advise 
that the case would be reviewed, which it was. In further email on 4 


May 2021, the Commissioner requested details of the personal data 
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purchased and held by Energy Suite, and whether any leads had been 


sourced through its website. 


On 11 May 2021, Energy Suite replied to explain that the data 
purchased included name, address and telephone number. It stated 
that leads were generated via Energy Suite’s website as well as via 


purchased data. 


On the same day, the Commissioner wrote to Energy Suite to request 
the volume of leads generated via Energy Suite’s website. It 
responded to say that 2,033 enquiries had come in via that route, and 


that all of these would have been contacted. 


On 19 May 2021, the Commissioner replied to Energy Suite to seek 
information about whether this figure was for connected or attempted 
calls, and how many of those called were TPS registered. On 21 May 
2021 Energy Suite replied stating that it did not hold this information. 
However, it seems inherently unlikely that every single such lead, of 
2,033 in total, answered the phone when called (even if called multiple 
times). The Commissioner therefore assumes that the number 2,033 
represents the number of people whom Energy Suite tried to contact, 
not the number whom it contacted successfully (whether via voicemail 


or otherwise). 


On 24 May 2021, the Commissioner wrote to Energy Suite to say that it 
had concluded its investigation and would consider whether 


enforcement action would be appropriate. 


The Commissioner is satisfied that the 1,246 calls were all made for the 


purposes of direct marketing as defined by section 122(5) DPA18. 
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The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of regulation 21 of PECR by Energy Suite and, if so, 


whether the conditions of section 55A DPA are satisfied. 
The contravention 


The Commissioner finds that Energy Suite contravened regulation 21 of 
PECR. 


The Commissioner finds that the contravention was as follows: 


Between 1 March and 13 November 2020, Energy Suite used a public 
telecommunications service for the purposes of making, on the balance 
of probabilities, at least 1,246 connected calls to subscribers whose 
number was listed on the TPS register. In that regard: 


a. it appears that 1,246 connected calls from Energy Suite’s 
main CLI, given above, were made to numbers that had been 
on the TPS register for at least 28 days prior to the call; 

b. whilst it is possible that some of those called may have opted 
into marketing calls by submitting an enquiry on Energy 
Suite’s website, Energy Suite was unable when asked to 
provide any detail of the calls made via website leads; 

c. in the absence of any evidence at all from Energy Suite in that 
respect, the Commissioner concludes from the available 
evidence that, on the balance of probabilities, most or all of 


the numbers on the TPS register were not allocated to people 
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who had notified Energy Suite, via the contact form on its 
website, that they did not object to being contacted; 
. further, given (i) the volume of additional calls made - some 
2,585 om (ii) Energy Suite’s 
inability to provide any evidence of notices of non-objection 
from the holders of the numbers called, or records of these 
calls, and (iii) the very large number of telephone numbers on 
the TPS register (c.18 million), on the balance of probabilities 
at least some of the additional calls - i.e. calls not made from 
the CLI given above - were likely to have been to numbers 
registered with TPS for at least 28 days prior to the call; 
. the Commissioner's conclusions in this regard are fortified by 
the fact that it has seen three complaints about Energy Suite 
in the relevant period from the holders of numbers registered 
on the TPS. The Commissioner considers that: 
i. those who complained to the TPS about Energy Suite 
would not have opted in via the company’s website; and 

ii. aS a matter of common sense and inherent probability, 
only a very small number of those who receive 
unsolicited marketing calls will in fact complain; 

iii. the Commissioner therefore infers from the three 
complaints made that a much larger number of 
unsolicited calls were in fact made to numbers 
registered on the TPS; 

. the Commissioner has been referred to a further complaint 
made on 6 April 2021, outside the period under investigation. 
This further complaint fortifies the Commissioner’s conclusion 
that Energy Suite’s compliance with PECR has been lax, and in 
turn that it has likely not taken effective steps to screen 


numbers called for TPS registration. 
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The Commissioner is also satisfied for the foregoing reasons that, for 
the purposes of regulation 21, these unsolicited direct marketing calls 
were made to subscribers who had registered with the TPS at least 28 
days prior to receiving the calls, and who for the purposes of regulation 


21(4) had not notified Energy Suite that they did not object to 


receiving such calls. 


For such notification to be valid under regulation 21(4), the individual 
must have taken a positive action to override their TPS registration and 
indicate their willingness to receive marketing calls from the company. 
The notification should reflect the individual’s choice about whether or 
not they are willing to receive marketing calls. Therefore, where 
signing up to use a product or service is conditional upon receiving 
marketing calls, companies will need to demonstrate how this 
constitutes a clear and positive notification of the individual’s 


willingness to receive such calls. 


The notification must clearly indicate the individual’s willingness to 
receive marketing calls specifically. Companies cannot rely on 
individuals opting into marketing communications generally, unless it is 


clear that this will include telephone calls. 


Further, the notification must demonstrate the individual’s willingness 
to receive marketing calls from that company specifically. Notifications 
will not be valid for the purposes of regulation 21(4) if individuals are 

asked to agree to receive marketing calls from “similar organisations”, 


"O 


“partners”, “selected third parties” or other similar generic descriptions. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
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Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because there have been multiple breaches 
of regulation 21 by Energy Suite arising from the organisation’s 
activities between 1 March and 13 November 2020 and this led to over 
1,000 unsolicited direct marketing calls being made to subscribers who 
were registered with the TPS and who had not notified Energy Suite 
that they were willing to receive such calls, and to three complaints 


being made as a result. 


In addition, Energy Suite made some 15,000 calls in total, including 
calls that were not connected to subscribers. Although the 
Commissioner has not been able to screen those numbers against the 
TPS register because has not retained records, the numbers were 
called without any due diligence as to their TPS status. Given the lack 
of any such due diligence, it is reasonable to assume that a significant 
number of these numbers will have been registered with the TPS. The 
attempt to contact a large number of other individuals who may well 
have been registered with the TPS, and/or without conducting any due 


diligence as to the same, aggravates the contravention. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner does not consider that Energy Suite deliberately set 
out to contravene PECR in this instance. He has therefore gone on to 
consider whether the contravention identified above was negligent. 


This consideration comprises two elements: 


15 


52. 


53. 


® 
1C O © 
Information Commissioner's Office 
Firstly, the Commissioner has considered whether Energy Suite knew 
or ought reasonably to have known that there was a risk that this 


contravention would occur. He is satisfied that this condition is met, for 


the following reasons: 


a. Energy Suite conducted a very large amount of direct 
telephone marketing as part of its business model, with some 
15,000 attempted calls, and 6,000 connected calls, over a 


period of some eight and a half months; 


b. in conducting such a large number of calls, Energy Suite ought 
reasonably to have familiarised itself with the legislation 
around direct marketing calls. It failed abjectly to do so - 
indeed, on the evidence, even to attempt to do so; 


c. further, the existence of legal controls on direct marketing and 
of the importance of the TPS register is widely known, and 
public awareness of wider data protection issues and of the 


importance of using data lawfully is also now widespread. 


The Commissioner has published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
This guidance explains the circumstances under which organisations 
are able to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be made to 
any subscriber registered with the TPS, unless the subscriber has 
specifically notified the company that they do not object to receiving 
such calls. In case organisations remain unclear on their obligations, 
the Commissioner operates a telephone helpline. ICO communications 


about previous enforcement action where businesses have not 
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complied with PECR are also readily available 


Standard practice of the TPS is to contact the organisation making the 
calls on each occasion a complaint is made, and indeed Energy Suite 
told the Commissioner in correspondence that TPS had been in contact 
after receipt of the complaints in issue. That there were three 
complaints made to the TPS over the period of the contravention 
should have made Energy Suite aware of the risk that such 


contraventions may occur and were indeed occurring. 


It is therefore reasonable to suppose that Energy Suite should have 


been aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether Energy 
Suite failed to take reasonable steps to prevent the contravention. 
Again, he is satisfied that this condition is met. 


The Commissioner's direct marketing guidance makes clear that 
organisations acquiring marketing lists from a third party must 
undertake rigorous checks to satisfy themselves that the personal data 
was obtained fairly and lawfully, that their details would be passed 
along for direct marketing to the specifically named organisation in the 
case of live calls, and that they have the necessary notifications for the 
purposes of regulation 21(4). It is not acceptable to rely on assurances 
given by third party suppliers without undertaking proper due 
diligence. No such checks were undertaken here, and a perusal of the 
websites of the companies in question, and of the documents that they 
provided to Energy Suite, does not give any good basis for thinking 


that their data was properly screened against the TPS register. 
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58. Reasonable steps that Energy Suite could have been expected to take 


in these circumstances may also have included: 


a. screening the data in question against the TPS register itself, 
regardless of the assurances given by the third parties in 
question; 

b. ensuring that it had in place an effective and robust 
suppression list; 

c. familiarising itself with the legislation and ICO guidance 
applicable to marketing calls, and providing training to its staff 


accordingly. 


59. Given the volume of calls and complaints, and indeed Energy Suite’s 
own submissions, it is clear that it failed to take those reasonable 


steps. 


60. The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner’s decision to issue a monetary penalty 


61. The Commissioner has taken into account the following aggravating 


features of this case: 


a. Energy Suite’s actions were done deliberately for financial gain, 
in that they aimed to generate sales and therefore profit; 

b. Energy Suite’s ignorance of the law was unacceptable given the 
nature of its business and the ready availability of guidance; 

c. although Energy Suite cooperated with the Commissioner, it 
was unable to provide much of the information that she 


requested due to the serious inadequacy of its record-keeping; 
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d. Energy Suite’s non-compliance appears to have continued after 
the period of contravention, with a further complaint about the 
company having been made to the TPS on 6 April 2021; 

e. because of its processes and poor record-keeping, Energy Suite 
was unable to say whether § calling leads from the 
Po might have withheld their numbers when doing 
so, thus raising the possibility that there had also been a breach 
of regulation 24 PECR as well, although this could not be 
confirmed. Energy Suite’s poor processes and record-keeping 
in this regard is itself culpable and raises the possibility that 
some of the calls were also non-compliant with regulation 24; 

f. one of the complaints indicates a reluctance on the part of 
Energy Suite’s employee to disclose to the subscriber where 
they had got that subscriber’s number, indicating an 
unwillingness on the company’s part to comply with the spirit 
of its obligations under the PECR (see paragraph 17 above). 


62. The Commissioner has taken into account the following mitigating 


features of this case: 


a. the company in question is small and may not be able to 
withstand a large penalty; 

b. the company has sought to cooperate to some degree with the 
Commissioner albeit its responses have been unsatisfactory; 

c. the volume of calls in this case is comparatively low compared 


to some of the other cases that have come before the ICO. 


63. For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. He is 
also satisfied that the procedural rights under section 55B have been 


complied with. 
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The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out his preliminary thinking. In reaching his final 
view, the Commissioner has taken into account the representations 


made by Energy Suite on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, he 


should exercise his discretion so as to issue a monetary penalty. 


The Commissioner has considered the likely impact of a monetary 
penalty on Energy Suite. He has decided that a penalty remains the 


appropriate course of action in the circumstances of this case. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only 
telephoning consumers who are not registered with the TPS and/or 
have specifically indicated that they do not object to receiving such 


calls. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 
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The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £2,000 (two thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 17 February 2022 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
16 February 2022 the Commissioner will reduce the monetary 
penalty by 20% to £1,600 (one thousand and six hundred 
pounds). However, you should be aware that the early payment 


discount is not available if you decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
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Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 18" day of January 2022 


Andy Curry 

Head of Investigations 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that he ought to have exercised 


his discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LEi 8DJ 
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Telephone: 0203 936 8963 


Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 


24 


Information Commissioner's Office 


and the reason why the notice of appeal was not provided in 


time. 


5. Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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